MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| commons-fileupload:commons-fileupload(Maven) | 0 | 1.3.1 | N/A |
| org.apache.tomcat:tomcat(Maven) | 8.0.0-RC1 | 8.0.3 | N/A |
| org.apache.tomcat:tomcat(Maven) | 7.0.0 | 7.0.52 | N/A |
CVSS Metrics
